TALLINN UNIVERSITY OF TECHNOLOGY Faculty of Information Technology Department of Computer Science TUT Centre for Digital Forensics and Cyber Security Hands-on laboratory on web content injection attacks Master’s thesis ITC70LT Anti Räis 121973IVCMM Supervisors Elar Lang, MSc Rain Ottis, PhD Tallinn 2015 Declaration I declare that this thesis is the result of my own research except as cited in the refer- ences. The thesis has not been accepted for any degree and is not concurrently submitted in candidature of any other degree. Anti Räis May 22, 2015 ........................ (Signature) Abstract This thesis focuses on explaining web application injection attacks in a practical hands-on laboratory. It is an improvement on Lang’s [1] master’s thesis about web appli- cation security. One of the main contributions of this thesis is gathering and structuring information about Cross Site Scripting (XSS) attacks and defenses and then presenting them in a practical learning environment. This is done to better explain the nuances and details that are involved in attacks against web applications. A thorough and clear under- standing of how these attacks work is the foundation for defense. The thesis is in English and contains 95 pages of text, 6 chapters, 4 figures, 27 tables. Annotatsioon Magistritöö eesmärk on selgitada kuidas töötavad erinevad kaitsemeetmed veebi- rakenduste rünnete vastu. Töö täiendab osaliselt Langi [1] magistritööd veebirakenduse rünnete kohta. Põhiline panus antud töös on koguda, täiendada ja struktureerida teavet XSS rünnete kohta ning luua õppelabor, kus on võimalik antud teadmisi praktikas rak- endada. See aitab kinnistada ja paremini mõista teemat. Selge ning täpne arusaamine, kuidas ründed toimuvad, on korrektse kaitse aluseks. Lõputöö on kirjutatud Inglise keeles ning sisaldab teksti 95 leheküljel, 6 peatükki, 4 joonist, 27 tabelit. Contents 1 Introduction 1 1.1 Problem statement and contribution of the thesis . .3 1.2 Implied expectations from the reader . .4 1.3 Outline of the thesis . .4 1.4 Ethical considerations . .4 1.5 Acknowledgments . .5 2 The essence of XSS 6 2.1 Ambiguity of XSS . .6 2.2 Definition of XSS . .7 2.3 Parsing a HTML document . .7 2.3.1 Parsing order . .8 2.3.2 Escape and encoding sequences . 10 2.3.3 Decoding order . 14 2.3.4 Notes about implementation . 16 2.4 Web content injection attacks . 18 2.4.1 HTML tag . 18 2.4.2 HTML attributes . 19 2.4.3 HTML comments . 21 2.4.4 URL as attribute value . 22 v 2.4.5 CSS . 24 2.4.6 Script tag and event handlers . 27 2.4.7 Overview of context specific characters . 29 2.5 XSS classification . 29 2.5.1 Reflected XSS . 30 2.5.2 Stored XSS . 31 2.5.3 DOM XSS . 32 2.5.4 Mutation XSS . 33 2.5.5 XSS in browser extensions . 34 2.5.6 Universal XSS . 35 3 XSS mitigation solutions 36 3.1 Defenses in the application . 36 3.1.1 Input sanitization . 36 3.1.2 Blacklisting . 37 3.1.3 “Stripping and replacing” . 37 3.1.4 Escaping . 37 3.1.5 Encoding . 38 3.1.6 Code rewriting . 38 3.2 Defenses on the server . 39 3.2.1 WAF . 39 3.2.2 Content Security Policy . 39 3.2.3 Response headers . 40 3.3 Defenses on the client-side . 43 3.3.1 SOP . 43 3.3.2 Internet Explorer’s XSS Auditor . 45 vi 3.3.3 Webkit’s XSS Auditor . 46 3.3.4 NoScript . 46 3.3.5 Shortcomings of XSS filter . 46 4 Defenses in different languages 48 4.1 ASP.NET . 48 4.2 JavaScript . 49 4.3 Java ..................................... 53 4.4 PHP . 56 4.5 Python . 58 4.6 Ruby . 59 5 Hands on laboratory 61 5.1 The purpose and expected result . 61 5.2 How to construct and conduct the training . 61 5.3 Laboratory . 62 5.3.1 Implementation . 63 5.4 Example exercise walk-through . 64 5.4.1 User input between HTML tags . 65 5.4.2 User input in JavaScript context . 65 5.4.3 User input in HTML element and URL contexts . 68 5.5 Constraints . 69 6 Conclusion 70 References 72 Code examples 81 vii List of Figures 84 List of Tables 85 List of acronyms 87 A Appendixes 89 A.1 Browser tolerance in accepting various characters . 89 viii 1. Introduction The trend in the software industry has been to make more and more services avail- able over the Internet. The web page is used as an administrative interface for services like electronic mail and e-commerce applications. Banks have long built their basic ser- vices to be used over the Internet and require only the crucial activities to be done in person [2]. In 2001 Estonia introduced X-Road [3], which provides the backbone for all the different services in use. Web site eesti.ee is one example, where the citizens can use different state related services and query information about themselves. These have become integral part of our everyday lives for large part of population. The author’s experience is, that developing a web service, just like any other soft- ware development project, can be a difficult task. The number of software dependencies increases as the project grows and evolves, e.g. addition software libraries are introduced to the system. This, in turn, makes it more complicated to manage and guarantee the correctness of the code [4]. The requirements change, meaning that a part of the sys- tem has to be written from scratch without breaking any other logic. There are also time constraints, that will force the developer to move to a next task as soon the previous func- tionality is working. All members of the team have to synchronize their work and agree on future tasks. This leads to inconsistencies and bugs since a single developer does not have the capability to handle all the dependencies correctly in a complex code base. All of those factors make it difficult to properly manage the development. In addition, developers make mistakes that lead to security issues. It takes years to learn and master the best practices of software development and apply them properly. In the meantime, the inexperienced developer continues to make the same mistakes and the overall security does not improve. Therefore, it is wise to use tools and frameworks, where several security related issues are resolved. Unfortunately, even using a well known and tested frameworks or languages does not guarantee a secure application [5–7]. Developing web services is a double edged sword - they provide the ease of access to 1 the information, but at the same time open the door to the malicious use. In 2013 a team of researches disclosed a vulnerability report about SOHO routers. They found that a Netgear WNDR4700 router could be exploited through a particular page that when visited by any user, authenticated or not, causes the router to no longer require a password to access the web administrative page [8]. Once activated, the all administrative functionality is visible to any user without credentials. Furthermore, once this vulnerability is exploited, it will persist through router reboots and is only removed through a factory reset. An attacker might only need one vulnerability, but the developer has to find them all. For example, after the Heartbleed vulnerability [9] was disclosed, researchers found additional issues with the code [10, 11]. The Open Web Application Security Project (OWASP) provides a TOP10 list of most prevalent issues regarding the software development [12]. We can see, that the top three issues have been the same compared to the previous report 1, which was published in 2010. Among them we can see a XSS vulnerability. In 2007 it was ranked as the topmost issue 2 and in 2004 it held a fourth position 3. Common Weakness Enumeration (CWE), which is published by the SANS institute, ranks XSS as fourth out of 25 most serious security vulnerabilities [13], supporting the fact that XSS is a serious problem. The OWASP provides resources for developers to read and study on that matter, however the XSS vulnerability has proven to be persistent in web applications. Defenses against XSS attacks has been studied before. Numerous researchers have proposed different solutions, e.g. defensive coding practices [14, 15], run-time monitoring solutions [16], XSS vulnerability testers and scanners both for run-time and for static code analysis. The secure coding practices provide the foundation of secure software, but it is prone to security issues because of human errors. Updated information about the latest XSS attack and defense vectors is fragmented. Keeping up and testing the latest bypasses requires additional time from developers. In addition, applying a defense must be done properly or the defense is inadequate. This is the problem that this thesis will address. 1https://www.owasp.org/index.php/OWASP_Top_10#OWASP_Top_10_for_2010 2https://www.owasp.org/index.php/Top_10_2007 3https://www.owasp.org/index.php/Top_10_2004 2 1.1 Problem statement and contribution of the thesis In 2012, Lang [1] created a web application security course to raise awareness about numerous security issues and to give a practical knowledge about different attack vectors. It consists of four days of theoretical attack scenarios together with practical hands-on laboratories. It focuses on applying the theoretical attack vectors in practice and from there, demonstrate how these could be mitigated. This ensures, that the participant has the necessary knowledge about how to apply various defenses and how they could be bypassed. One part of it is covering different web application injections attacks, discussed in the following chapters. Many participants have expressed their wish for more in depth explanation how to properly defend against it.